AuthCookies final readonly class

Minn\Auth\AuthCookies · public/minn/src/Minn/Auth/AuthCookies.php · 107 lines

The three cookies a sign-in sets: the auth cookie on the admin and plugins paths (the secure variant over HTTPS, keyed off that scheme's salt) and the logged_in cookie on the site root, which is the one REST reads. Every value shares the username|expiration|token|hmac shape.

Uses 5

Cookie Password Content\UserRecord Db Http\Response

Used by 2

SignIn Engine

Constants and properties

private	`DAY` = `86400`
private	`HOUR` = `3600`
private	`readonly Minn\Db $db`	Promoted from the constructor.
private	`readonly Minn\Auth\Cookie $cookie`	Promoted from the constructor.

Public

new __construct(Minn\Db $db, Minn\Auth\Cookie $cookie)#

method

hash(): string#

The hash suffixed onto every cookie name: md5 of the siteurl option.

method

settle(Minn\Content\UserRecord $user, int $days, bool $secure, bool $https, string $token = ''): array#

The sign-in cookies as the reference settles them (suite login-hooks): their life through auth_cookie_expiration (two days, or fourteen when remembered, the cookies then kept twelve hours past it); the auth cookie's security through secure_auth_cookie, and the logged-in cookie's through secure_logged_in_cookie (secure only over HTTPS); a session made for that life when none is given; then set_auth_cookie and set_logged_in_cookie told the values, and send_auth_cookies asked whether to send them. Signing in always runs under the booted runtime (its sessions are WordPress's), so the hooks always run.

@return array{expiration: int, expire: int, secure: bool, secureLoggedIn: bool, scheme: string, token: string, auth: string, loggedIn: string, send: bool}

method

attach(Minn\Http\Response $response, array $plan): Minn\Http\Response#

The response with the settled cookies on it: the auth cookie on the admin and plugins paths, the logged-in cookie on the site root; none when send_auth_cookies said not to.

$plan array{expire: int, secure: bool, secureLoggedIn: bool, auth: string, loggedIn: string, send: bool} from settle()

method

clearing(): bool#

Whether signing out clears the cookies: clear_auth_cookie told, then send_auth_cookies asked with no cookie in hand, as the reference asks them (suite login-hooks).

method

clear(Minn\Http\Response $response): Minn\Http\Response#

The response with every sign-in cookie expired.

static

mint(Minn\Content\UserRecord $user, int $expiration, string $token, string $scheme): string#

A cookie value under any scheme's salt (auth, secure_auth, logged_in).